Berlin refused to pay. Now it runs four task forces

Berlin refused to pay. The data went up on Friday. The German capital now runs two police task forces, a joint departmental unit, a crisis management team and an external legal adviser.

That is what refusing a ransom looks like once the deadline passes. The State of Berlin set out that machinery itself, in a press release from its Senate Chancellery. It went out on 3 September, the day before the criminals said they would publish.

Berlin’s state government said on Saturday that it was reviewing the material with the highest intensity, Miranda Murray reported for Reuters. A central crisis unit will verify the contents and tell the people affected.

The departments hit were transport and housing

The attackers reached two Senate departments. One covers Mobility, Transport, Climate Protection and Environment. The other covers Urban Development, Construction and Housing.

Say that plainly, because some coverage has placed national defence material in the dump. Berlin is a city-state. Its Senate departments run buses, building permits and housing benefit. German national defence belongs to the federal government and the Bundeswehr, not to a city administration.

Berlin’s own account of what may be in the files is narrower and more mundane. It says the data may include personal information on state employees, on residents and on businesses.

Der Spiegel published a screenshot of Rhysida’s dark web listing in August, which the BBC then reported. On it the group claimed contracts, non-disclosure agreements, personnel files, passwords and thousands of personal contact details. That inventory is the criminals’ own, and nobody outside the investigation has checked it.

What refusing actually costs

Berlin published its own response, which makes this unusually well documented. The State Criminal Police Office and the transport department each set up a special task force. The two affected departments then formed a joint one.

The housing department runs its own crisis management team and has opened a contact point for staff. It also hired an external legal adviser for confidential or legally sensitive matters. An ICT emergency task force meets until further notice.

Berlin is working with the state prosecutor, the Federal Office for Information Security and other federal agencies. It sees no current evidence that the attackers still hold the state network. Forensic work continues on whether they took more than anyone yet knows.

One line in the press release is easy to skim past. Berlin has told police officers that counselling and support services exist for people who come in to report their data in the dump. A city has budgeted for residents needing looking after.

Berlin asks anyone who finds their own data to file a criminal complaint, online or at a station. The Senate departments will contact identified individuals directly, on a risk basis, under the GDPR and the Berlin Data Protection Act.

Every number here belongs to the attackers

The size of the theft is Rhysida’s claim rather than a measurement. Berlin says the group asserts it holds 5.7 terabytes. Reuters and the BBC both give 5.79. Nobody outside the group selling the files has confirmed either number.

The price is firmer. The auction opened at a minimum bid of 30 bitcoin, which Berlin puts at roughly €2m.

Treat one published conversion with care. Reuters gives the 30-bitcoin minimum as $77,622, which would value a single bitcoin at about $2,587. Multiply $77,622 by thirty and the answer is $2.33m, which matches Berlin’s own euro figure. The bracket appears to hold the price of one coin rather than the total.

Rhysida has run this play before

The pattern is the group’s business model rather than a reaction to Berlin. Rhysida hit the British Museum in 2023 and took around 500,000 files. The museum refused to pay, and the group published them.

Rhysida has claimed hundreds of attacks since emerging in 2023, against governments and companies in many countries. Researchers place it in Russia and eastern Europe.

Refusal is now common enough to have a shape. Grafana Labs turned down a ransom in May after attackers stole code that was already open source. Kenya investigated a bitcoin demand over its president’s website in July. Coca-Cola halted US production at a subsidiary after an attack in the same month.

Fifteen days before an election

Berlin votes on 20 September. The data landed on 4 September.

State senator Iris Spranger says the attack did not reach election infrastructure. Berlin has separately urged the public not to circulate unverified claims about the contents. The timing makes that a hard request to grant.

The attack itself began earlier. Officials date an initial leak to between 7 and 12 August. Berlin shut down two departmental networks on 14 August, which stopped housing benefit applications for several days, and forensic work later found further losses in the transport and environment department.

Berlin sits in a country where 87% of companies reported an attack last year. Attackers have also reached European institutions through officials’ own messaging accounts.

Two men, one sentence

Mayor Kai Wegner said on 28 August that Berlin would not be blackmailed. Florian Hauer, the state’s chief digital officer, said almost exactly the same thing on 3 September.

Hauer called an attack on the state network a serious crime that harms everyone, and said the safety of staff and residents came first. Berlin described the incident as an extremely serious crime and an attack on the state itself.

Nobody has yet published the part that would settle the argument. What did the attackers want beyond money, does anyone stand behind them, and what is actually in 5.7 terabytes. Berlin says its investigations continue. Until they report, the only firm number in this story is the price the criminals set.